November 8, 2024

ESET researchers noticed a number of campaigns focusing on governmental establishments in Thailand, beginning in 2023. These assaults leveraged revamped variations of parts beforehand attributed by different researchers to the China-aligned superior persistent menace (APT) group Mustang Panda, and later, a brand new set of instruments that abuse service suppliers similar to Pastebin, Dropbox, OneDrive, and GitHub to execute instructions on compromised computer systems and exfiltrate delicate paperwork.

Primarily based on our findings, we determined to trace this exercise cluster because the work of a separate menace actor. The quite a few occurrences of the string [Bb]ectrl within the code of the group’s instruments impressed us to call it CeranaKeeper; it’s a wordplay between the phrases beekeeper and the bee species Apis Cerana, or the Asian honey bee.

Key factors of this blogpost:

  • ESET researchers found a brand new China-aligned menace actor, CeranaKeeper, focusing on governmental establishments in Thailand. A few of its instruments have been beforehand attributed to Mustang Panda by different researchers.
  • The group continually updates its backdoor to evade detection and diversifies its strategies to help huge knowledge exfiltration.
  • CeranaKeeper abuses fashionable, reputable cloud and file-sharing companies similar to Dropbox and OneDrive to implement customized backdoors and extraction instruments.
  • The group makes use of GitHub’s pull request and difficulty remark options to create a stealthy reverse shell, leveraging GitHub, a preferred on-line platform for sharing and collaborating on code, as a C&C server.

CeranaKeeper has been energetic since at the very least the start of 2022, primarily focusing on governmental entities in Asian nations similar to Thailand, Myanmar, the Philippines, Japan, and Taiwan; we consider it’s aligned with China’s pursuits. The group’s relentless hunt for knowledge is exceptional, with its attackers deploying a big selection of instruments aimed toward extracting as a lot data as attainable from compromised networks. Within the operation we analyzed, the group turned compromised machines into replace servers, devised a novel method utilizing GitHub’s pull request and difficulty remark options to create a stealthy reverse shell, and deployed single-use harvesting parts when accumulating whole file bushes.

We briefly launched CeranaKeeper within the ESET APT Exercise Report This autumn 2023–Q1 2024, which was launched in Might 2024. On this blogpost, we describe these beforehand undocumented, customized instruments deployed by CeranaKeeper and share extra of our findings concerning the operations of this menace actor.

We introduced a few of our findings about CeranaKeeper and the compromise in Thailand on the Virus Bulletin conference on October 2nd, 2024, and in our white paper, which you’ll learn in full here. This month, Virus Bulletin may even publish our white paper about this subject on its website.

Attribution

Whereas a few of CeranaKeeper’s actions had beforehand been attributed to Mustang Panda (aka Earth Preta or Stately Taurus) by Talos, Trend Micro, and Palo Alto Networks Unit 42, we have now determined to trace this exercise cluster because the work of CeranaKeeper. We consider CeranaKeeper makes use of the publicly documented toolset known as bespoke stagers (or TONESHELL), closely depends on the side-loading method, and makes use of a selected sequence of instructions to exfiltrate recordsdata from a compromised community. Moreover, we contemplate using political lures and PlugX parts to be the work of MustangPanda. Regardless of some similarities of their actions (related side-loading targets, archive format), we noticed distinct organizational and technical variations between the 2 teams, similar to variations of their toolsets, infrastructure, operational practices, and campaigns. We additionally famous variations in the way in which the 2 teams accomplish related duties.

In its operations, CeranaKeeper deploys parts generally known as TONEINS, TONESHELL, and PUBLOAD, that are distinctive to the group. The group stands out for its creativity and adaptableness in its assaults, similar to utilizing revamped variations of the aforementioned parts and new instruments that abuse companies similar to Pastebin, Dropbox, OneDrive, and GitHub. We describe these instruments within the Toolset aiding massive exfiltration part.

Moreover, the group left some metadata in its code that offered us with insights into its improvement course of, additional solidifying our separation of the 2 teams and our attribution to CeranaKeeper. Each menace actors could depend on the identical third celebration, similar to a provider of instruments used within the deployment part, which isn’t unusual amongst China-aligned teams, or have some degree of knowledge sharing, which might clarify the hyperlinks that we have now noticed. In our opinion, it is a extra doubtless clarification than a single menace actor sustaining two fully separate units of instruments, infrastructure, operational practices, and campaigns.

Compromising machines in the identical community

The compromise vectors that CeranaKeeper used within the case we analyzed have but to be discovered. When the group obtained a foothold within the community of a Thai governmental establishment, in the midst of 2023, a compromised machine carried out brute-force assaults towards a website controller server within the native space community.

After gaining privileged entry, the attackers put in the TONESHELL backdoor, deployed a device to dump credentials, and used a reputable Avast driver and a customized utility to disable safety merchandise on the machine. From this compromised server, they used a distant administration console to deploy and execute their backdoor on different computer systems within the community. Moreover, CeranaKeeper used the compromised server to retailer updates for TONESHELL, turning it into an replace server.

The group deployed a brand new BAT script throughout the community, extending its attain to different machines in the identical area by exploiting the area controller to realize area admin privileges. This enabled CeranaKeeper to maneuver to the following part of its operation and obtain the ultimate objective: huge knowledge harvesting.

Toolset aiding huge exfiltration

After deploying their TONESHELL backdoor and performing a number of lateral actions, it seems that the attackers discovered and chosen a number of compromised computer systems of ample curiosity to deploy beforehand undocumented, customized instruments. These help instruments have been used not solely to facilitate the exfiltration of paperwork to public storage companies but additionally to behave as different backdoors. The backdoors and exfiltration instruments we describe have been deployed to extremely focused machines solely.

WavyExfiller: A Python uploader abusing Dropbox and PixelDrain

The primary of a sequence of unknown parts we found in June 2023 is WavyExfiller, a Python bundle bundled into an executable utilizing PyInstaller and a direct Python implementation of the exfiltration technique described by Unit 42. We named this part WavyExfiller as a result of .wav extension of an area file that comprises search masks for figuring out and compressing paperwork prepared for export. The PyInstaller-bundled executable is called SearchApp.exe (SHA-256: E7B6164B6EC7B7552C93713403507B531F625A8C64D36B60D660D66E82646696).

The module has three most important capabilities: to retrieve an encrypted Dropbox token from a Pastebin web page (an internet service for storing and sharing plain textual content knowledge), to create password-protected archives of paperwork present in customers’ directories, and to add these archives to Dropbox.

In October 2023, we noticed a variant (SHA-256: 451EE465675E674CEBE3C42ED41356AE2C972703E1DC7800A187426A6B34EFDC) saved below the title oneDrive.exe. Regardless of its title, this model makes use of the file-sharing service PixelDrain to exfiltrate the archived recordsdata. Identical to SearchApp.exe talked about above, this variant checks the C drive, which usually comprises the working system, put in packages, and native customers’ paperwork. Moreover, oneDrive.exe makes an attempt to gather recordsdata from mapped drives, if any, starting from letter D to N (besides L) as illustrated in Determine 1, which can characterize related exterior storage gadgets like USBs and laborious drives, networked drives in an workplace setting, or digital drives created by particular software program. This exhibits that CeranaKeeper stepped up its degree of greediness and tried reaching different potential or identified sources of knowledge. Nonetheless, it’s unclear whether or not the exfiltration operation was profitable, as checking uploaded recordsdata on PixelDrain just isn’t attainable by way of the uncovered API.

Determine 1. Traversing and accumulating recordsdata from a listing of drives

DropboxFlop: A Python backdoor abusing Dropbox

In October 2023, across the similar time that we discovered the PixelDrain variant, we found a brand new PyInstaller bundled executable with SHA-256 hash DAFAD19900FFF383C2790E017C958A1E92E84F7BB159A2A7136923B715A4C94F. It appears that evidently CeranaKeeper created it primarily based on a publicly accessible mission known as Dropflop, which is a reverse shell with add and obtain capabilities. The compiled Python file known as dropboxflop.pyc. The backdoor retrieves an encrypted Dropbox token and will depend on recordsdata current within the distant Dropbox repository to execute instructions on the machine. It creates a novel folder regionally and generates a “heartbeat” by updating the distant file known as lasttime each 15 seconds. It additionally checks for a file named duties that, if discovered, is downloaded and parsed as a JSON file. There are two sorts of duties applied: command execution and file add. As soon as accomplished, the backdoor sends the outcomes by updating the content material of the file output.

OneDoor: A C++ backdoor abusing OneDrive

Just a few days after deploying the Python backdoor DropboxFlop, CeranaKeeper returned with a statically linked C/C++ backdoor abusing OneDrive that we have now named OneDoor. The pattern (SHA-256: 3F81D1E70D9EE39C83B582AC3BCC1CDFE038F5DA31331CDBCD4FF1A2D15BB7C8) is called OneDrive.exe. The file mimics the reputable executable from Microsoft, as proven within the properties view in Determine 2.

Determine 2. OneDoor file properties

OneDoor behaves in a similar way to the DropboxFlop backdoor, however makes use of the OneDrive REST API of the Microsoft Graph API to obtain instructions and exfiltrate recordsdata.

OneDoor creates a log file and makes an attempt to entry a file named config.ini. If it’s not current, OneDoor makes use of a hardcoded buffer. The file or buffer begins with a key and an initialization vector, that are used to decrypt the remainder of the information utilizing AES-128 in CBC mode. The plaintext comprises a URL, which the malware makes use of in an HTTP GET request. The response comprises a OneDrive token, which is utilized in subsequent requests to Microsoft OneDrive.

OneDoor additionally retrieves the ID of a folder known as approot, which is used to retailer utility knowledge.

Just like the config.ini file, the malware makes an attempt to entry a file named errors.log. If the file doesn’t exist, it makes use of a hardcoded buffer. The content material of the file or buffer is decrypted; the plaintext knowledge comprises a 1024-bit RSA public key. A key-IV pair is generated, encrypted with RSA, and uploaded to the distant approot folder. This pair is used for encrypting and decrypting knowledge.

Lastly, the malware retrieves lists of recordsdata from two folders positioned on OneDrive, E and F. A thread is began for every record, which downloads and decrypts the recordsdata. The recordsdata saved below the E folder comprise instructions to be executed, whereas those saved below the F folder comprise a listing of recordsdata to be uploaded. The outcomes of those operations are encrypted and saved in a 3rd OneDrive folder, D. The unique recordsdata are then deleted from OneDrive.

BingoShell: A Python backdoor abusing GitHub

We noticed the newest specimen of the group’s exfiltration toolset in February 2024 and named it BingoShell due to the string bingo# used within the title of a GitHub pull request (PR) it creates. The analyzed pattern (SHA-256: 24E12B8B1255DF4E6619ED1A6AE1C75B17341EEF7418450E661B74B144570017) is a file named Replace.exe that makes use of a Microsoft Workplace emblem as its icon, as noticed in Determine 3. In accordance with its PE compilation timestamp, apparently it was in-built late January 2024.

Determine 3. BingoShell backdoor mimics Microsoft Workplace utility

BingoShell is a backdoor written in Python that makes use of GitHub to regulate compromised machines. As soon as run, it makes use of a hardcoded token to entry a personal GitHub repository. In accordance with the preliminary commit of the primary department, the repository was in all probability created on January twenty fourth, 2024. BingoShell creates a brand new department within the repository and a corresponding pull request. The backdoor reads feedback on the newly created PR to obtain instructions to execute on the compromised machine, as illustrated in Determine 4. 

Determine 4. Code retrieving instructions saved in difficulty feedback

This demonstrates a brand new covert method to leverage GitHub as a command and management (C&C) server, displaying the sophistication of the attackers, who cleaned up after themselves by closing pull requests and eradicating feedback from the repository.

Every new department created by BingoShell on the personal GitHub repository ought to characterize an entry to a compromised machine. As a result of we found 25 closed pull requests (proven in Determine 5), we may infer that CeranaKeeper had entry, by way of BingoShell, to 25 compromised machines.

Determine 5. Enumerating the pull requests

Conclusion

The menace actor behind the assaults on the Thailand authorities, CeranaKeeper, appears notably relentless, because the plethora of instruments and strategies the group makes use of retains evolving at a fast fee. The operators write and rewrite their toolset as wanted by their operations and react quite shortly to maintain avoiding detection. This group’s objective is to reap as many recordsdata as attainable and it develops particular parts to that finish. CeranaKeeper makes use of cloud and file-sharing companies for exfiltration and doubtless depends on the truth that visitors to those fashionable companies would largely appear reputable and be tougher to dam when it’s recognized.

All through our analysis, we have been capable of set up robust connections between the beforehand documented and new toolsets and one widespread menace actor. The overview of the ways, strategies and procedures (TTPs), code, and infrastructure discrepancies leads us to consider that monitoring CeranaKeeper and MustangPanda as two separate entities is critical. Nonetheless, each China-aligned teams could possibly be sharing data and a subset of instruments in a typical curiosity or by the identical third celebration.

The focused marketing campaign we investigated gave us insights into CeranaKeeper’s operations and future campaigns will doubtless reveal extra, because the group’s quest for delicate knowledge continues.

For a extra detailed evaluation of the instruments deployed by CeranaKeeper, you may entry the complete ESET Analysis white paper here.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at [email protected]
ESET Analysis provides personal APT intelligence studies and knowledge feeds. For any inquiries about this service, go to the ESET Threat Intelligence web page.

IoCs

A complete record of indicators of compromise (IoCs) and samples may be present in our GitHub repository.

Information

SHA-256 Filename Detection Description
B25C79BA507A256C9CA12A9BD34DEF6A33F9C087578C03D083D7863C708ECA21 EACore.dll

Win32/Agent.VJO

YK0130 reverse shell.

E7B6164B6EC7B7552C93713403507B531F625A8C64D36B60D660D66E82646696 SearchApp.exe

Python/Agent.AGT

WavyExfiller.

3F81D1E70D9EE39C83B582AC3BCC1CDFE038F5DA31331CDBCD4FF1A2D15BB7C8 OneDrive.exe

Win32/Agent.VKV

OneDoor.

DAFAD19900FFF383C2790E017C958A1E92E84F7BB159A2A7136923B715A4C94F dropbox.exe

Python/Agent.AQN

PyInstaller DropFlop.

24E12B8B1255DF4E6619ED1A6AE1C75B17341EEF7418450E661B74B144570017 Replace.exe

Python/Agent.AJJ

BingoShell.

451EE465675E674CEBE3C42ED41356AE2C972703E1DC7800A187426A6B34EFDC oneDrive.exe

Python/Agent.AGP

WavyExfiller PixelDrain variant.

E6AB24B826C034A6D9E152673B91159201577A3A9D626776F95222F01B7C21DB MsOcrRes.orp

Win32/Agent.AFWW

TONESHELL sort B.

6655C5686B9B0292CF5121FC6346341BB888704B421A85A15011456A9A2C192A avk.dll

Win32/Agent.VJQ

TONESHELL variant.

B15BA83681C4D2C2716602615288B7E64A1D4A9F4805779CEBDF5E6C2399AFB5 TurboActivate.dll

Win32/Agent.AFWX

TONESHELL loader.

Community

IP  Area  Internet hosting supplier  First seen  Particulars 
104.21.81[.]233 
172.67.165[.]197 
www.toptipvideo[.]com  CLOUDFLARENET (AS13335)  2023‑08‑14  C&C server for the YK0130 reverse shell. 
103.245.165[.]237  dljmp2p[.]com 
inly5sf[.]com 
Bangmod Enterprise administrator (AS58955)  2023‑04‑21  C&C servers for TONESHELL variants. 
103.27.202[.]185  www.dl6yfsl[.]com  Bangmod Enterprise administrator (AS58955)  2023‑08‑10  C&C server for TONEINS variant. 
103.27.202[.]185  www.uvfr4ep[.]com  Bangmod Enterprise administrator (AS58955)  2023‑09‑22  C&C server for TONEINS variant. 

MITRE ATT&CK strategies

This desk was constructed utilizing version 15 of the MITRE ATT&CK framework.

Tactic  ID  Title  Description 
Useful resource Improvement  T1583.001  Purchase Infrastructure: Domains  CeranaKeeper acquired domains for a few of its C&C servers. 
T1583.003  Purchase Infrastructure: Digital Personal Server  CeranaKeeper acquired entry to a VPS to function a C&C server. 
T1587.001  Develop Capabilities: Malware  CeranaKeeper develops its personal parts. 
T1585.003  Set up Accounts: Cloud Accounts  CeranaKeeper acquired cloud accounts for exfiltration functions. 
Execution  T1072  Software program Deployment Instruments  CeranaKeeper abuses the ESET Distant Administration console to carry out lateral motion. 
Persistence  T1547.001  Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder  The YK0130 reverse shell establishes persistence by way of the registry Run key. 
T1574.002  Hijack Execution Stream: DLL Facet-Loading  Most parts come as side-loaded libraries together with the reputable program. 
Protection Evasion  T1140  Deobfuscate/Decode Information or Data  Configuration recordsdata utilized by the OneDrive backdoor are encrypted. 
T1036.005  Masquerading: Match Official Title or Location  CeranaKeeper makes use of reputable library names to mix in. 
Assortment  T1560.001  Archive Collected Information: Archive by way of Utility  WavyExfiller makes use of WinRAR to compress collected knowledge. 
T1005  Information from Native System  WavyExfiller collects knowledge from the native drive (C:). 
T1039  Information from Community Shared Drive  WavyExfiller collects knowledge from community shares. 
T1074.001  Information Staged: Native Information Staging  Collected knowledge is archived in a particular folder earlier than being uploaded. 
Command and Management  T1071.001  Software Layer Protocol: Net Protocols  The completely different backdoors talk utilizing HTTP/S. 
T1132.002  Information Encoding: Non-Commonplace Encoding  The community protocol utilized by the YK0130 reverse shell employs customized, XOR-based encoding. 
T1573.001  Encrypted Channel: Symmetric Cryptography  AES-128 mode CBC is utilized by the OneDrive backdoor to encrypt community communication. 
T1573.002  Encrypted Channel: Uneven Cryptography  The generated key and IV for the OneDrive backdoor are encrypted by way of RSA. 
T1090.001  Proxy: Inside Proxy  One of many variants of the YK0130 reverse shell implements a reverse proxy. 
T1102.002  Net Service: Bidirectional Communication  OneDrive and Dropbox are used as C&C servers. 
Exfiltration  T1567.002  Exfiltration Over Net Service: Exfiltration to Cloud Storage  Collected knowledge are exfiltrated by way of cloud companies.